A redundant fuel-metering system is disclosed in U.S. patent application entitled "Safety and Emergency Driving Method for an Internal Combustion Engine with Self-Ignition and an Arrangement for the Performance of this Method" having Ser. No. 885,166 and filed on July 14, 1986, now U.S. Pat. No. 4,791,900 and claiming priority from German patent application P 35 31 198.3. This fuel-metering system includes an analog main controller and an analog substitute controller. A comparator continuously determines whether the control deviation remains within a predetermined limit. If the comparator determines that this is not the case, then the comparator emits a switch-over signal which actuates a switch-over unit. The switch-over unit then no longer supplies the output signal of the main controller to the actuator for adjusting the control rod of the fuel pump and, instead, supplies the output signal of the substitute controller. The desired value for both controllers is supplied by a microcomputer.
Published German patent application DE 35 39 407 A1 discloses a fuel-metering system having two microprocessors which both operate as digital controllers. The two processors share the computer load during normal operation. One of the processors computes the desired value for the fuel control and the other microprocessor computes the control deviation and the desired value. In the case of a fault, each of the two processors can maintain an emergency operation as an emergency computer. Among other quantities, the emergency computer then computes the desired value as well as the actuating value for the fuel control with a simplified program.
A fuel-metering system has been in production for several years and includes an analog controller and two microprocessors. One of the microprocessors takes over the function of the digital controller when the analog controller malfunctions. The second microprocessor emits a switch-over signal as soon as the first microprocessor or the analog controller malfunctions. The switch-over signal switches a switch-over unit so that the output signal from the analog controller can no longer be supplied to the actuator for the fuel-control device.
In fuel-metering systems having a switch-over unit and an auxiliary controller for the above-mentioned purpose, the problem is present that the switch-over device or the auxiliary controller can also malfunction. This presents a lack of reliability which should be eliminated.